d62b808a71f8d7ce0df60a6632c5389367687b9d7af9c42feea951d12822913b

Analysis

max time kernel
139s
max time network
140s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6887ba96fd9da6f9fb77d787aa648152_JaffaCakes118.html
Size

60KB
MD5

6887ba96fd9da6f9fb77d787aa648152
SHA1

2df25d1d4abf14bac9760960e0026fc1c4ac575f
SHA256

d62b808a71f8d7ce0df60a6632c5389367687b9d7af9c42feea951d12822913b
SHA512

ed4d314baded13da6c24a51e7e3204fa25f3e9d47564441e9ebf6f6cc44747cdc29ba16f016130dffce0face06fa96222efa3f068347a3a738238af52b3cd503
SSDEEP

768:dBsWPChxgGtku8S+LuL27Y9D64xN9KFE2SoS:+37ku6uLn9KFS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422571757"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000f9392825b0810994d66b60f84d9b6311509d3cdc1d6b423f13b8b74eb5f4bba7000000000e80000000020000200000008b6b7ebe6aebda0530211627f7140a3e82566c67efeebc1071e378777806159390000000ba25b34553f42601c230809c8459f0d89c9bbf38454a928d5766896c109744bff9a6418328ffd6e1ac705f5412895f656581e5cc5af0d17dc0dc11f41a766aea7270e9ab7d2ed24c7961fc080a4e751ea0b4bdc3cdf3f7d3b7c691db6a4635b6fc4cc0fca483ea00c64e37c85506c974b38ac7c079646bb4fb29b6a3d67b0a44fc2e9795c33ff42045b6e21a9fdfc40c40000000f8e4384af14c7bccd8c25cb8a7ef93b4696a662aef767e2ff8189996101eab8ad41d702cf7c2be2f6f4ec0b30cb2c70c6efb27dd6e07909dc033d12e9a7783b4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4027B6E1-187A-11EF-B781-461900256DFE} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000005fda583ccb0e7e2858def759d5efaa2e31b6b33dd3d44ecb057abc6364993271000000000e800000000200002000000003821073a4ef522bdfbb6efd0e3712aaee3fd4edde7337e114d75831a1d1a9bf20000000287a2a5b25518d7539b6bdaef1d9f2a650a04dfabd7fa973ce3cac93057adccf40000000154b34c25dee50991f420af84cc8e3482866a7afbcaab0367216e843c5afe8575142f9573082dd84aaf8bac611beccc9fae27c8eb07dd7ad466e80fdcfb294b4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b07ccf1687acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3000 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3000 iexplore.exe
3000 iexplore.exe
2812 IEXPLORE.EXE
2812 IEXPLORE.EXE
2812 IEXPLORE.EXE
2812 IEXPLORE.EXE

pid	process
3000	iexplore.exe

pid	process
3000	iexplore.exe
3000	iexplore.exe
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 3000 wrote to memory of 2812	3000	iexplore.exe	IEXPLORE.EXE
PID 3000 wrote to memory of 2812	3000	iexplore.exe	IEXPLORE.EXE
PID 3000 wrote to memory of 2812	3000	iexplore.exe	IEXPLORE.EXE
PID 3000 wrote to memory of 2812	3000	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6887ba96fd9da6f9fb77d787aa648152_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
79d0cadfd7acafd0188df6635a246f56

SHA1
a8e7495bcff0806c6a5b31fc6b08543289699d43

SHA256
7c296604d830825e999232ccd15b839036264c5b4cf9b2396471f50ba4e73f10

SHA512
d646390d82b3aab412c484a534a0f36fcd40c8b77f53498bb2754f06c64b5b9671e036602155f4ffc1d3cc7c166b24a980243254b3b9cd7acedaeac327a159b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7c3b54e8067e983261760f6a16b0a3a

SHA1
665481ef2c9b6e5483f5d88f0aebaa602062b098

SHA256
d58a0f775bba8d39f9bd04fedfc9f98c61dcc2f86fcb961e6c4a57a128a55f6d

SHA512
97cfbd00656007f8115bb7f5d20738bfc48f1831e5f9826b0db512b41566eb3834f49fbc0d39af90ae02ec27e1c83c403b46c62fe449754c051ea0522f75d1c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eeda12bec5ce3394d2ef4bff578b9ad4

SHA1
681b38db9201187e02a6f519ef33a00f56033bb1

SHA256
45701b9ced39b7d094916aafe874408f91de644a3f875ce269b56db45c30753d

SHA512
f21f1104346d0707b00ec95325dea97892c48a4a4348eec9205647982b5b8f07a08dc179a0d1594757dd269b7a57ec9ecbf7726839a3feaceb71758cb3b711d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ea5db9bc6e725805732272acceba11e

SHA1
e906bb753708c8bdc906d52873ec5c688518da1b

SHA256
7c2b9e9ef1c608c2c32da5bce399148572cc4410b892ff192329a8d2445abcc6

SHA512
8d4d979ec1d65ac9ba175140be4cd87656dd2fd68e26cc1107e023a1940602eb2aec6a3ce2032447719a292510a00f25f47d721c7c8a6b42371c1c6d0cbb44d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
072e582602897751d99a08cdfe0ebac2

SHA1
34ae0156a8df43107dc07c8543a2ab80ca3f1893

SHA256
7a9c5c29c45f870f87200a749db9b6dcf728d7895152a1e5bb2b24a5c69d3153

SHA512
5533a5fd314e351144645a1fc1f0466c2ba91d9d93bf395e8c14d67fd895c72f7966d65acbc66e53577fb710cc4f42584e79d0f56f01f9a5b405f1ddfbb2ed3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dee61ab5dd7c27d6818fbd1c3f319426

SHA1
7ec2c28c3ba9752924314358410c481d149de825

SHA256
2616268e4c2f6396244e84d33b92b96c8655864a054dacf505c154269163cc68

SHA512
13d74d21f4966f082b5af9793eaed50c9ccc50af5db9cd30880c8c54d2d0b2340e11cf48f6d385143cf75c28e55301f0087d195f9591d6921a78802fdb604378

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c861075a37152e50510bdbc76cb305c

SHA1
7fdeb6d1dda05518c30fbe72a43b2564d4eccb89

SHA256
084729a73aa99d48760f713ccb29d829cca184b6a69b8e4d2bd2c0acef8c8634

SHA512
91d7c3d3cd65bf07bd2a1d1ef7f50822d6d01dc14fabbf51996b09e2f0c7cc58c3fba31a92f36deac9495fe390979346e02f566ffc2c1d810ab469b63758691d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ede582af686af4652b6f7f02dc367305

SHA1
e0d07a3caa2f21a568a9a1aa084b96ce4f5f41ae

SHA256
c90d69665ba3c44e812ec98856b30abdc883e5187a41f592f6c6ab993122e871

SHA512
9898e09fc140585fc6c7941baba8c6681fa069a851f48436eb8fa130d5779291c90bb5457207b9f7dabe639032e0bca4b8fe77d2ce723859f39525a34dd7efaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee9cc948479e1e49559f6de33bdd47d3

SHA1
5b8ef65375d6504d0af22f02b3746db4c6be272a

SHA256
2bdb6c018542879450d131ec4dc5ff961d90c34a321e31b0dac94650879f4782

SHA512
98e270c19e19719d1832eb1e6e09344ab79fe120cb507e6dcf9ebd8fd8d31d200421f75e953f5c9c84f75bc6520fa596270ac7728f8862ae517882951ccda76c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30c2c1001e4a59d5abd66433f34df7ca

SHA1
328c6bf3321e67b130fda0a1dfa162f10d230bb5

SHA256
cb7874d0a699e9a2999bce02762131d5fabd13c85c615f5c3c7b4f4fab791814

SHA512
0620a9f569a662eb9f72542d4b468db17fa02f727a0952d5d0190059eb9068c504052ca629dc8012395917ee45f03a542d8cca3c552301edd0ecb1035ec6ede6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ddd55a54f25260ab118f4c4420e254f

SHA1
7bb528585b15ad7e15b0e0546e4c03aa868ca235

SHA256
4e35177d9957536f0368d3223a7c4f3682f5faf035113ecec1f1796281dde98e

SHA512
0f510a41f372073f1e8c1002e8806e5630aa718932e1dfffaeb7a0f90807fb164c9b6e3ea955070cf729bc45a7a478be804c781fd3929bbbd2f222acc39e6fdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
6d72f6db2dfa117c1bb5976385a70d34

SHA1
f9531f877762f1cd16505d2202beef3da0bc806f

SHA256
a555f53b4727d1c3849061efca3592fa13ef9d156bc2dab384ed04614755c115

SHA512
70dc89db3ba67e920674662fd5318628b4ef668e0584d170eb25f17312f83d94d7f3b17a94c56c51b025bd8bd3e4a9add5c16a76ed2cd156fb50dbd9194112db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab37E3.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3863.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit